Close the bridged-process hole in the drag-out hand-off gate

OsHandoff now needs the window-ownership proof AND a hit-test that named
nothing, so a bridged plugin's UI can't read as off-REAPER.

tests/test_instrument_drop.cpp

@@ -248,20 +248,15 @@ static void testUnnamedReaperSurfacesAreOther() {
     CHECK(surfaceFor("something_reaper_adds_in_2030") == ReaperSurface::Other);
 }
 
-// An empty info string is Other, NOT an off-REAPER verdict. GetThingFromPoint documents no
-// off-REAPER return at all, so its silence over the transport, the toolbar or the docker chrome
-// says only "nothing I name" — reading it as "the user left REAPER" is what handed live drags to
-// OLE mid-gesture. Whether the pointer left REAPER is a window-ownership fact the shell proves
-// separately (drag_out_win::pointerOverHostWindow) and feeds to the law as
-// DropContext::pointerOffHost; no classifier output can produce a hand-off on its own.
+// An empty info string is Other, NOT an off-REAPER verdict — ui::DropContext::pointerOffHost
+// owns why.
 static void testEmptyInfoIsOtherNotOffReaper() {
     CHECK(surfaceFor("") == ReaperSurface::Other);
 }
 
-// There is deliberately no second empty-info case: track presence stopped being an input to the
-// classifier when the off-REAPER verdict left the vocabulary. "No classifier output can trigger a
-// hand-off" is now structural (no such member exists; test_drag_out's static_assert pins the
-// member count) rather than something a per-token loop could falsify.
+// There is deliberately no second empty-info case: track presence is not an input to the
+// classifier, and "no classifier output alone can trigger a hand-off" is structural (no such
+// member exists) rather than something a per-token loop could falsify.
 
 // Do not reintroduce a per-surface "capture carries" loop test: buildInstrumentDropPreset takes
 // only sampleId (proven by testPresetRoundTripsThroughInstrumentReader), and per-surface